

<!DOCTYPE html>
<html lang="zh-CN" data-default-color-scheme=auto>



<head>
  <meta charset="UTF-8">
  <link rel="apple-touch-icon" sizes="76x76" href="https://img.mkerosene.cn/touxiang.jpg">
  <link rel="icon" href="https://img.mkerosene.cn/touxiang.jpg">
  <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=5.0, shrink-to-fit=no">
  <meta http-equiv="x-ua-compatible" content="ie=edge">
  
    <meta http-equiv="Content-Security-Policy" content="upgrade-insecure-requests">
  
  <meta name="theme-color" content="#2f4154">
  <meta name="author" content="Kerosene W">
  <meta name="keywords" content="">
  
    <meta name="description" content="Web.0x01.  backup  题目提示为备份文件，如果网站存在备份文件，常见的备份文件后缀名有：“.git” 、“.svn”、“ .swp”“.~”、“.bak”、“.bash_history”、“.bkf” 尝试在URL后面，依次输入常见的文件备份扩展名(index.php.*)。  尝试到.bak时下载了一个文件，使用记事本打开得到flag。     0x02.  weak_auth">
<meta property="og:type" content="article">
<meta property="og:title" content="攻防世界writeup(新手区)">
<meta property="og:url" content="http://example.com/2021/04/08/%E6%94%BB%E9%98%B2%E4%B8%96%E7%95%8Cwriteup-%E6%96%B0%E6%89%8B%E5%8C%BA/index.html">
<meta property="og:site_name" content="追求源于热爱">
<meta property="og:description" content="Web.0x01.  backup  题目提示为备份文件，如果网站存在备份文件，常见的备份文件后缀名有：“.git” 、“.svn”、“ .swp”“.~”、“.bak”、“.bash_history”、“.bkf” 尝试在URL后面，依次输入常见的文件备份扩展名(index.php.*)。  尝试到.bak时下载了一个文件，使用记事本打开得到flag。     0x02.  weak_auth">
<meta property="og:locale" content="zh_CN">
<meta property="og:image" content="https://img.mkerosene.cn/新手区.jpg">
<meta property="article:published_time" content="2021-04-08T14:13:17.000Z">
<meta property="article:modified_time" content="2021-10-18T03:44:21.682Z">
<meta property="article:author" content="Kerosene W">
<meta property="article:tag" content="writeup">
<meta name="twitter:card" content="summary_large_image">
<meta name="twitter:image" content="https://img.mkerosene.cn/新手区.jpg">
  
  
  <title>攻防世界writeup(新手区) - 追求源于热爱</title>

  <link  rel="stylesheet" href="https://cdn.jsdelivr.net/npm/bootstrap@4/dist/css/bootstrap.min.css" />


  <link  rel="stylesheet" href="https://cdn.jsdelivr.net/npm/github-markdown-css@4/github-markdown.min.css" />
  <link  rel="stylesheet" href="/lib/hint/hint.min.css" />

  
    
    
      
      <link  rel="stylesheet" href="https://cdn.jsdelivr.net/npm/highlight.js@10/styles/github-gist.min.css" />
    
  

  
    <link  rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@fancyapps/fancybox@3/dist/jquery.fancybox.min.css" />
  


<!-- 主题依赖的图标库，不要自行修改 -->

<link rel="stylesheet" href="//at.alicdn.com/t/font_1749284_ba1fz6golrf.css">



<link rel="stylesheet" href="//at.alicdn.com/t/font_1736178_kmeydafke9r.css">


<link  rel="stylesheet" href="/css/main.css" />

<!-- 自定义样式保持在最底部 -->


  <script id="fluid-configs">
    var Fluid = window.Fluid || {};
    var CONFIG = {"hostname":"example.com","root":"/","version":"1.8.13","typing":{"enable":true,"typeSpeed":70,"cursorChar":"_","loop":false},"anchorjs":{"enable":true,"element":"h1,h2,h3,h4,h5,h6","placement":"right","visible":"hover","icon":"❡"},"progressbar":{"enable":true,"height_px":3,"color":"#29d","options":{"showSpinner":false,"trickleSpeed":100}},"copy_btn":true,"image_zoom":{"enable":true,"img_url_replace":["",""]},"toc":{"enable":true,"headingSelector":"h1,h2,h3,h4,h5,h6","collapseDepth":0},"lazyload":{"enable":true,"loading_img":"https://img.mkerosene.cn/loading.gif","onlypost":false,"offset_factor":2},"web_analytics":{"enable":true,"baidu":null,"google":null,"gtag":null,"tencent":{"sid":null,"cid":null},"woyaola":null,"cnzz":null,"leancloud":{"app_id":"FI1uAFAYz0Q3MPDiORqd0JAN-gzGzoHsz","app_key":"EhKAjMe3bmq0WLTSgktGg2OC","server_url":null,"path":"window.location.pathname","ignore_local":false}},"search_path":"/local-search.xml"};
  </script>
  <script  src="/js/utils.js" ></script>
  <script  src="/js/color-schema.js" ></script>
</head>


<body>
  <header style="height: 70vh;">
    <nav id="navbar" class="navbar fixed-top  navbar-expand-lg navbar-dark scrolling-navbar">
  <div class="container">
    <a class="navbar-brand" href="/">
      <strong>mKerosene</strong>
    </a>

    <button id="navbar-toggler-btn" class="navbar-toggler" type="button" data-toggle="collapse"
            data-target="#navbarSupportedContent"
            aria-controls="navbarSupportedContent" aria-expanded="false" aria-label="Toggle navigation">
      <div class="animated-icon"><span></span><span></span><span></span></div>
    </button>

    <!-- Collapsible content -->
    <div class="collapse navbar-collapse" id="navbarSupportedContent">
      <ul class="navbar-nav ml-auto text-center">
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/">
                <i class="iconfont icon-home-fill"></i>
                首页
              </a>
            </li>
          
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/archives/">
                <i class="iconfont icon-archive-fill"></i>
                归档
              </a>
            </li>
          
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/categories/">
                <i class="iconfont icon-category-fill"></i>
                分类
              </a>
            </li>
          
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/tags/">
                <i class="iconfont icon-tags-fill"></i>
                标签
              </a>
            </li>
          
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/links/">
                <i class="iconfont icon-link-fill"></i>
                友链
              </a>
            </li>
          
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/about/">
                <i class="iconfont icon-user-fill"></i>
                关于
              </a>
            </li>
          
        
        
          <li class="nav-item" id="search-btn">
            <a class="nav-link" target="_self" href="javascript:;" data-toggle="modal" data-target="#modalSearch" aria-label="Search">
              &nbsp;<i class="iconfont icon-search"></i>&nbsp;
            </a>
          </li>
        
        
          <li class="nav-item" id="color-toggle-btn">
            <a class="nav-link" target="_self" href="javascript:;" aria-label="Color Toggle">&nbsp;<i
                class="iconfont icon-dark" id="color-toggle-icon"></i>&nbsp;</a>
          </li>
        
      </ul>
    </div>
  </div>
</nav>

    <div class="banner" id="banner" parallax=true
         style="background: url('https://img.mkerosene.cn/default.png') no-repeat center center;
           background-size: cover;">
      <div class="full-bg-img">
        <div class="mask flex-center" style="background-color: rgba(0, 0, 0, 0.3)">
          <div class="page-header text-center fade-in-up">
            <span class="h2" id="subtitle" title="攻防世界writeup(新手区)">
              
            </span>

            
              <div class="mt-3">
  
  
    <span class="post-meta">
      <i class="iconfont icon-date-fill" aria-hidden="true"></i>
      <time datetime="2021-04-08 22:13" pubdate>
        2021年4月8日 晚上
      </time>
    </span>
  
</div>

<div class="mt-1">
  
    <span class="post-meta mr-2">
      <i class="iconfont icon-chart"></i>
      4.3k 字
    </span>
  

  
    <span class="post-meta mr-2">
      <i class="iconfont icon-clock-fill"></i>
      
      
      14 分钟
    </span>
  

  
  
    
      <!-- LeanCloud 统计文章PV -->
      <span id="leancloud-page-views-container" class="post-meta" style="display: none">
        <i class="iconfont icon-eye" aria-hidden="true"></i>
        <span id="leancloud-page-views"></span> 次
      </span>
    
  
</div>

            
          </div>

          
        </div>
      </div>
    </div>
  </header>

  <main>
    
      

<div class="container-fluid nopadding-x">
  <div class="row nomargin-x">
    <div class="d-none d-lg-block col-lg-2"></div>
    <div class="col-lg-8 nopadding-x-md">
      <div class="container nopadding-x-md" id="board-ctn">
        <div class="py-5" id="board">
          <article class="post-content mx-auto">
            <!-- SEO header -->
            <h1 style="display: none">攻防世界writeup(新手区)</h1>
            
              <p class="note note-info">
                
                  本文最后更新于：1 年前
                
              </p>
            
            <div class="markdown-body">
              <h2 id="Web"><a href="#Web" class="headerlink" title="Web."></a>Web.</h2><h3 id="0x01-backup"><a href="#0x01-backup" class="headerlink" title="0x01.  backup"></a>0x01.  backup</h3><p><img src="http://img.mkerosene.cn/image-20210408222034138.png" srcset="https://img.mkerosene.cn/loading.gif" lazyload alt="image-20210408222034138"></p>
<ul>
<li><p>题目提示为备份文件，如果网站存在备份文件，常见的备份文件后缀名有：“.git” 、“.svn”、“ .swp”“.~”、“.bak”、“.bash_history”、“.bkf” 尝试在URL后面，依次输入常见的文件备份扩展名(index.php.*)。</p>
</li>
<li><p>尝试到<code>.bak</code>时下载了一个文件，使用记事本打开得到flag。</p>
</li>
</ul>
<p><img src="http://img.mkerosene.cn/Snipaste_2021-04-08_22-25-17.png" srcset="https://img.mkerosene.cn/loading.gif" lazyload alt="image-20210408222034138"></p>
<hr>
<h3 id="0x02-weak-auth"><a href="#0x02-weak-auth" class="headerlink" title="0x02.  weak_auth"></a>0x02.  weak_auth</h3><img src="https://img.mkerosene.cn/屏幕截图 2021-04-14 170249.png" srcset="https://img.mkerosene.cn/loading.gif" lazyload alt="屏幕截图 2021-04-14 170249" style="zoom:67%;" />

<ul>
<li>题目如图，且任意输入用户名提示<code>please login as admin</code>，这里使用Burp Suite的Intruder模块暴力破解</li>
<li>输入admin，密码随意输入（万一蒙中了呢😊），Bs截断包</li>
</ul>
<img src="https://img.mkerosene.cn/屏幕截图 2021-04-14 170457.png" srcset="https://img.mkerosene.cn/loading.gif" lazyload alt="屏幕截图 2021-04-14 170457" style="zoom: 67%;" />

<ul>
<li>点击action发送到Intruder模块</li>
</ul>
<img src="https://img.mkerosene.cn/屏幕截图 2021-04-14 170713.png" srcset="https://img.mkerosene.cn/loading.gif" lazyload alt="屏幕截图 2021-04-14 170713" style="zoom:67%;" />

<ul>
<li>选择Cluster bomb类型，使用Auto自动识别两个变量</li>
</ul>
<img src="https://img.mkerosene.cn/屏幕截图 2021-04-14 170749.png" srcset="https://img.mkerosene.cn/loading.gif" lazyload alt="屏幕截图 2021-04-14 170749" style="zoom:67%;" />

<ul>
<li>分别设置两个变量的内容，密码从load中选择文件</li>
</ul>
<img src="https://img.mkerosene.cn/屏幕截图 2021-04-14 170836.png" srcset="https://img.mkerosene.cn/loading.gif" lazyload alt="屏幕截图 2021-04-14 170836" style="zoom:67%;" />

<ul>
<li>暴力开始，点击<code>Start attack</code></li>
<li>结果中出现两种长度</li>
</ul>
<img src="https://img.mkerosene.cn/屏幕截图 2021-04-14 171031.png" srcset="https://img.mkerosene.cn/loading.gif" lazyload alt="屏幕截图 2021-04-14 171031" style="zoom:67%;" />

<img src="https://img.mkerosene.cn/屏幕截图 2021-04-14 171147.png" srcset="https://img.mkerosene.cn/loading.gif" lazyload alt="屏幕截图 2021-04-14 171147" style="zoom:67%;" />

<ul>
<li>密码即为123456，getFlag！</li>
</ul>
<p>tip: 更详细的操作可参考<a target="_blank" rel="noopener" href="https://www.bilibili.com/video/BV1SJ41197g2/?spm_id_from=333.788.recommend_more_video.1">B站Up主视频</a></p>
<hr>
<h3 id="0x03-simple-php"><a href="#0x03-simple-php" class="headerlink" title="0x03.  simple_php"></a>0x03.  simple_php</h3><figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br></pre></td><td class="code"><pre><code class="hljs php"><span class="hljs-meta">&lt;?php</span><br>show_source(<span class="hljs-keyword">__FILE__</span>);<br><span class="hljs-keyword">include</span>(<span class="hljs-string">&quot;config.php&quot;</span>);<br><span class="hljs-variable">$a</span>=@<span class="hljs-variable">$_GET</span>[<span class="hljs-string">&#x27;a&#x27;</span>];<br><span class="hljs-variable">$b</span>=@<span class="hljs-variable">$_GET</span>[<span class="hljs-string">&#x27;b&#x27;</span>];<br><span class="hljs-keyword">if</span>(<span class="hljs-variable">$a</span>==<span class="hljs-number">0</span> <span class="hljs-keyword">and</span> <span class="hljs-variable">$a</span>)&#123;<br>    <span class="hljs-keyword">echo</span> <span class="hljs-variable">$flag1</span>;<br>&#125;<br><span class="hljs-keyword">if</span>(is_numeric(<span class="hljs-variable">$b</span>))&#123;<br>    <span class="hljs-keyword">exit</span>();<br>&#125;<br><span class="hljs-keyword">if</span>(<span class="hljs-variable">$b</span>&gt;<span class="hljs-number">1234</span>)&#123;<br>    <span class="hljs-keyword">echo</span> <span class="hljs-variable">$flag2</span>;<br>&#125;<br><span class="hljs-meta">?&gt;</span><br></code></pre></td></tr></table></figure>

<ul>
<li>网页内容如上</li>
<li>该题为一个简单的php弱类型比较</li>
<li><code>is_numeric()</code> 函数会判断如果是数字和数字字符串则返回 TRUE，否则返回 FALSE</li>
<li>php中有两种比较符号<code>=== </code>会同时比较字符串的值和类型，<code>== </code>会先将字符串换成相同类型，再作比较，属于弱类型比较</li>
</ul>
<p>引</p>
<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br></pre></td><td class="code"><pre><code class="hljs php"><span class="hljs-number">1</span> <span class="hljs-meta">&lt;?php</span><br><span class="hljs-number">2</span> var_dump(<span class="hljs-string">&quot;admin&quot;</span>==<span class="hljs-number">0</span>);  <span class="hljs-comment">//true</span><br><span class="hljs-number">3</span> var_dump(<span class="hljs-string">&quot;1admin&quot;</span>==<span class="hljs-number">1</span>); <span class="hljs-comment">//true</span><br><span class="hljs-number">4</span> var_dump(<span class="hljs-string">&quot;admin1&quot;</span>==<span class="hljs-number">1</span>) <span class="hljs-comment">//false</span><br><span class="hljs-number">5</span> var_dump(<span class="hljs-string">&quot;admin1&quot;</span>==<span class="hljs-number">0</span>) <span class="hljs-comment">//true</span><br><span class="hljs-number">6</span> var_dump(<span class="hljs-string">&quot;0e123456&quot;</span>==<span class="hljs-string">&quot;0e4456789&quot;</span>); <span class="hljs-comment">//true </span><br><span class="hljs-number">7</span> <span class="hljs-meta">?&gt;</span>  <span class="hljs-comment">//上述代码可自行测试</span><br><span class="hljs-comment">/* 观察上述代码，&quot;admin&quot;==0 比较的时候，会将admin转化成数值，强制转化,由于admin是字符串，转化的结果是0自然和0相等</span><br><span class="hljs-comment"> &quot;1admin&quot;==1 比较的时候会将1admin转化成数值,结果为1，而“admin1“==1 却等于错误，也就是&quot;admin1&quot;被转化成了0</span><br><span class="hljs-comment"> &quot;0e123456&quot;==&quot;0e456789&quot;相互比较的时候，会将0e这类字符串识别为科学技术法的数字，0的无论多少次方都是零，所以相等</span><br><span class="hljs-comment"></span><br><span class="hljs-comment">当一个字符串欸当作一个数值来取值，其结果和类型如下:如果该字符串没有包含&#x27;.&#x27;,&#x27;e&#x27;,&#x27;E&#x27;并且其数值值在整形的范围之内</span><br><span class="hljs-comment">该字符串被当作int来取值，其他所有情况下都被作为float来取值，该字符串的开始部分决定了它的值，如果该字符串以合法的数值开始，则使用该数值，否则其值为0。</span><br><span class="hljs-comment">*/</span><br></code></pre></td></tr></table></figure>

<img src="https://img.mkerosene.cn/屏幕截图 2021-04-13 153027.png" srcset="https://img.mkerosene.cn/loading.gif" lazyload alt="屏幕截图 2021-04-13 153027" style="zoom:67%;" />

<hr>
<h3 id="0x04-xff-referer"><a href="#0x04-xff-referer" class="headerlink" title="0x04.  xff_referer"></a>0x04.  xff_referer</h3><ul>
<li>X-Forwarded-For:简称XFF头，它代表客户端，也就是HTTP的请求端真实的IP，只有在通过了HTTP 代理或者负载均衡服务器时才会添加该项</li>
<li>HTTP Referer是header的一部分，当浏览器向web服务器发送请求的时候，一般会带上Referer，告诉服务器我是从哪个页面链接过来的</li>
<li>因此请求头添加X-Forwarded-For:123.123.123.123返回要求来自google</li>
<li>继续添加<code>Referer: https://www.google.com</code>得到flag</li>
</ul>
<hr>
<h3 id="0x05-command-execution"><a href="#0x05-command-execution" class="headerlink" title="0x05. command_execution"></a>0x05. command_execution</h3><figure class="highlight less"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br></pre></td><td class="code"><pre><code class="hljs less"><span class="hljs-selector-tag">A</span>|<span class="hljs-selector-tag">B</span><br><span class="hljs-selector-tag">1</span>、不管<span class="hljs-selector-tag">A</span>成功还是失败，两着都会执行，但只输出<span class="hljs-selector-tag">B</span>的结果<br><span class="hljs-selector-tag">A</span><span class="hljs-selector-tag">&amp;</span><span class="hljs-selector-tag">B</span><br><span class="hljs-selector-tag">1</span>、<span class="hljs-selector-tag">A</span>、<span class="hljs-selector-tag">B</span>都会执行并输出<br><span class="hljs-selector-tag">A</span>||<span class="hljs-selector-tag">B</span><br><span class="hljs-selector-tag">1</span>、先执行命令<span class="hljs-selector-tag">A</span>，如果失败则再执行命令<span class="hljs-selector-tag">B</span><br><span class="hljs-selector-tag">2</span>、如果<span class="hljs-selector-tag">A</span>成功，就不执行<span class="hljs-selector-tag">B</span><br><span class="hljs-selector-tag">A</span><span class="hljs-selector-tag">&amp;</span><span class="hljs-selector-tag">&amp;</span><span class="hljs-selector-tag">B</span><br><span class="hljs-selector-tag">1</span>、如果命令<span class="hljs-selector-tag">A</span>成功执行，则执行命令<span class="hljs-selector-tag">B</span>，并输出<br><span class="hljs-selector-tag">2</span>、如果命令<span class="hljs-selector-tag">A</span>没有执行成功，就不会执行命令<span class="hljs-selector-tag">B</span><br></code></pre></td></tr></table></figure>

<ul>
<li><code>没有写waf</code>,因此只需方框中输入<code>| find / -name &quot;flag.txt&quot;</code>，回显flag文件的路径，再使用<code>| cat xxx</code>打开查看flag。</li>
</ul>
<h2 id="Misc"><a href="#Misc" class="headerlink" title="Misc."></a>Misc.</h2><h3 id="0x01-如来十三掌"><a href="#0x01-如来十三掌" class="headerlink" title="0x01.  如来十三掌"></a>0x01.  如来十三掌</h3><img src="https://img.mkerosene.cn/屏幕截图 2021-04-16 142633.png" srcset="https://img.mkerosene.cn/loading.gif" lazyload alt="屏幕截图 2021-04-16 142633" style="zoom: 67%;" />

<ul>
<li>附件中为</li>
</ul>
<figure class="highlight"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs">夜哆悉諳多苦奢陀奢諦冥神哆盧穆皤三侄三即諸諳即冥迦冥隸數顛耶迦奢若吉怯陀諳怖奢智侄諸若奢數菩奢集遠俱老竟寫明奢若梵等盧皤豆蒙密離怯婆皤礙他哆提哆多缽以南哆心曰姪罰蒙呐神。舍切真怯勝呐得俱沙罰娑是怯遠得呐數罰輸哆遠薩得槃漫夢盧皤亦醯呐娑皤瑟輸諳尼摩罰薩冥大倒參夢侄阿心罰等奢大度地冥殿皤沙蘇輸奢恐豆侄得罰提哆伽諳沙楞缽三死怯摩大蘇者數一遮<br></code></pre></td></tr></table></figure>

<ul>
<li>应该是<a target="_blank" rel="noopener" href="http://www.keyfc.net/bbs/tools/tudoucode.aspx">与佛论禅</a>编码，解码时加前缀“佛曰：”（冒号为中文）</li>
</ul>
<img src="攻防世界writeup-新手区/Snipaste_2021-04-16_14-37-56.png" srcset="https://img.mkerosene.cn/loading.gif" lazyload alt="Snipaste_2021-04-16_14-37-56" style="zoom: 67%;" />

<ul>
<li>然后题目中提示如来十三掌，继续<a target="_blank" rel="noopener" href="http://www.mxcz.net/tools/rot13.aspx">rot-13</a>解码</li>
<li>再一次Base64解码得到flag</li>
</ul>
<hr>
<h3 id="0x02-gif"><a href="#0x02-gif" class="headerlink" title="0x02.  gif"></a>0x02.  gif</h3><p><img src="https://img.mkerosene.cn/2021-04-16_150215.png" srcset="https://img.mkerosene.cn/loading.gif" lazyload alt="2021-04-16_150215"></p>
<ul>
<li>题目描述为gif图片，打开附件是104个黑白图片，费解。。。参考wp说是二进制，白色为0，黑为1</li>
<li>然后<a target="_blank" rel="noopener" href="http://www.txttool.com/t/?id=NDE5">二进制转字符串</a>，getFlag</li>
</ul>
<img src="https://img.mkerosene.cn/2021-04-16_153130.png" srcset="https://img.mkerosene.cn/loading.gif" lazyload alt="2021-04-16_153130" style="zoom:50%;" />

<hr>
<h3 id="0x03-base64stego"><a href="#0x03-base64stego" class="headerlink" title="0x03.  base64stego"></a>0x03.  base64stego</h3><ul>
<li>[zip伪加密][<a target="_blank" rel="noopener" href="https://blog.mkerosene.cn/2020/12/25/BUUCTF-wp/#2-zip%E4%BC%AA%E5%8A%A0%E5%AF%86]">https://blog.mkerosene.cn/2020/12/25/BUUCTF-wp/#2-zip%E4%BC%AA%E5%8A%A0%E5%AF%86]</a></li>
<li>base64隐写</li>
<li>脚本如下：</li>
</ul>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br></pre></td><td class="code"><pre><code class="hljs python"><span class="hljs-comment"># bin/decode.py</span><br>base64 = <span class="hljs-string">&quot;ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/&quot;</span><br><span class="hljs-function"><span class="hljs-keyword">def</span> <span class="hljs-title">change</span>(<span class="hljs-params">string_test</span>) :</span><br>    strings_ans = <span class="hljs-string">&quot;&quot;</span><br>    <span class="hljs-keyword">for</span> every <span class="hljs-keyword">in</span> string_test :<br>        bin_num = <span class="hljs-string">&quot;&quot;</span><br>        <span class="hljs-keyword">if</span> every == <span class="hljs-string">&quot;=&quot;</span> :<br>            <span class="hljs-keyword">return</span> strings_ans<br>        <span class="hljs-keyword">else</span> :<br>            num = base64.find(every)<br>            <span class="hljs-keyword">while</span> num != <span class="hljs-number">0</span> :<br>                bin_num += <span class="hljs-built_in">str</span>(num%<span class="hljs-number">2</span>)<br>                num = <span class="hljs-built_in">int</span>(num/<span class="hljs-number">2</span>)<br>            <span class="hljs-keyword">while</span> <span class="hljs-built_in">len</span>(bin_num) &lt;<span class="hljs-number">6</span> :<br>                bin_num += <span class="hljs-string">&quot;0&quot;</span><br>            bin_num = bin_num[::-<span class="hljs-number">1</span>]<br>        strings_ans += bin_num<br>    <span class="hljs-keyword">return</span> strings_ans<br><span class="hljs-function"><span class="hljs-keyword">def</span> <span class="hljs-title">answer</span>(<span class="hljs-params">strings_last</span>) :</span><br>    ans = <span class="hljs-string">&quot;&quot;</span><br>    strings_temp = change(strings_last)<br>    <span class="hljs-keyword">if</span> strings_last.count(<span class="hljs-string">&#x27;=&#x27;</span>) == <span class="hljs-number">1</span> :<br>        ans += strings_temp[-<span class="hljs-number">2</span>:]<br>    <span class="hljs-keyword">else</span> :<br>        ans += strings_temp[-<span class="hljs-number">4</span>:]<br>    <span class="hljs-keyword">return</span> ans<br><span class="hljs-keyword">with</span> <span class="hljs-built_in">open</span>(<span class="hljs-string">&quot;stego.txt&quot;</span>,<span class="hljs-string">&quot;r&quot;</span>) <span class="hljs-keyword">as</span> in_file :   <span class="hljs-comment">#输入文件的名称</span><br>    strings_first = in_file.readlines()<br>    strings = []<br>    <span class="hljs-keyword">for</span> every_strings <span class="hljs-keyword">in</span> strings_first :<br>        <span class="hljs-keyword">if</span> every_strings[-<span class="hljs-number">2</span>] ==<span class="hljs-string">&quot;=&quot;</span> :<br>            strings.append(every_strings)<br><span class="hljs-keyword">with</span> <span class="hljs-built_in">open</span>(<span class="hljs-string">&quot;out.txt&quot;</span>,<span class="hljs-string">&quot;w&quot;</span>) <span class="hljs-keyword">as</span> out_file :    <span class="hljs-comment">#输出文件的名称</span><br>    ans = <span class="hljs-string">&quot;&quot;</span><br>    <span class="hljs-keyword">for</span> line <span class="hljs-keyword">in</span> strings :<br>        ans += answer(line)<br>    num = <span class="hljs-number">0</span><br>    list_num = []<br>    <span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> <span class="hljs-built_in">range</span>(<span class="hljs-number">0</span>,<span class="hljs-built_in">len</span>(ans)) :<br>        num = num*<span class="hljs-number">2</span>+<span class="hljs-built_in">int</span>(ans[i])<br>        <span class="hljs-keyword">if</span> (i+<span class="hljs-number">1</span>)%<span class="hljs-number">8</span> == <span class="hljs-number">0</span> :<br>            list_num.append(num)<br>            num = <span class="hljs-number">0</span><br>    ans = <span class="hljs-string">&quot;&quot;</span><br>    <span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> list_num :<br>        ans += <span class="hljs-built_in">chr</span>(i)<br>    out_file.write(ans)<br></code></pre></td></tr></table></figure>

<hr>
<h3 id="0x04-SimpleRAR"><a href="#0x04-SimpleRAR" class="headerlink" title="0x04. SimpleRAR"></a>0x04. SimpleRAR</h3><ul>
<li>打开压缩包（winRAR），发现损坏文件</li>
<li>010 editor打开</li>
</ul>
<p>![image-20211018104759662](C:\Users\23135\Pictures\Saved Pictures\image-20211018104759662.png)</p>
<ul>
<li><p>7A改成74（子块改为文件块）<a target="_blank" rel="noopener" href="https://blog.csdn.net/weixin_42542313/article/details/103653185">https://blog.csdn.net/weixin_42542313/article/details/103653185</a></p>
</li>
<li><p>secret.png显示，据题目提示双图层，ps打开，改后缀gif</p>
</li>
<li><p>两个图层分别导出，使用stegsolve打开，找到部分二维码</p>
</li>
<li><p>使用ps补全定位符号，扫码得到flag</p>
</li>
</ul>
<hr>
<h3 id="0x05-ext3"><a href="#0x05-ext3" class="headerlink" title="0x05. ext3"></a>0x05. ext3</h3><ul>
<li><p>工具：ext3grep：<code>apt-get install ext3grep</code></p>
</li>
<li><p>二进制文件，使用file命令检查</p>
</li>
</ul>
<figure class="highlight apache"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs apache"><span class="hljs-attribute">f1fc23f5c743425d9e0073887c846d23</span>: Linux rev <span class="hljs-number">1</span>.<span class="hljs-number">0</span> ext<span class="hljs-number">3</span> filesystem data, UUID=cf<span class="hljs-number">6</span>d<span class="hljs-number">7</span>bff-c<span class="hljs-number">377</span>-<span class="hljs-number">403</span>f-<span class="hljs-number">84</span>ae-<span class="hljs-number">956</span>ce<span class="hljs-number">3</span>c<span class="hljs-number">99</span>aaa<br></code></pre></td></tr></table></figure>

<ul>
<li>确定为ext3文件系统的镜像中的恢复文件</li>
<li>先过滤出flag相关文件<code>strings f1fc23f5c743425d9e0073887c846d23 | grep -i flag</code></li>
</ul>
<figure class="highlight stylus"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><code class="hljs stylus"><span class="hljs-selector-class">.flag</span><span class="hljs-selector-class">.txt</span><span class="hljs-selector-class">.swp</span><br>flag<span class="hljs-selector-class">.txtt</span><span class="hljs-selector-class">.swx</span><br>~root/Desktop/file/O7avZhikgKgbF/flag<span class="hljs-selector-class">.txt</span><br><span class="hljs-selector-class">.flag</span><span class="hljs-selector-class">.txt</span><span class="hljs-selector-class">.swp</span><br>flag<span class="hljs-selector-class">.txtt</span><span class="hljs-selector-class">.swx</span><br><span class="hljs-selector-class">.flag</span><span class="hljs-selector-class">.txt</span><span class="hljs-selector-class">.swp</span><br>flag<span class="hljs-selector-class">.txtt</span>.swx<br></code></pre></td></tr></table></figure>

<ul>
<li>定位到<code>~root/Desktop/file/O7avZhikgKgbF/flag.txt</code>使用ext3grep恢复查找此文件</li>
<li>base64解密得到flag</li>
</ul>

            </div>
            <hr>
            <div>
              <div class="post-metas mb-3">
                
                  <div class="post-meta mr-3">
                    <i class="iconfont icon-category"></i>
                    
                      <a class="hover-with-bg" href="/categories/Cyber-Security/">Cyber-Security</a>
                    
                  </div>
                
                
                  <div class="post-meta">
                    <i class="iconfont icon-tags"></i>
                    
                      <a class="hover-with-bg" href="/tags/writeup/">writeup</a>
                    
                  </div>
                
              </div>
              
                <p class="note note-warning">
                  
                    本博客所有文章除特别声明外，均采用 <a target="_blank" href="https://creativecommons.org/licenses/by-sa/4.0/deed.zh" rel="nofollow noopener noopener">CC BY-SA 4.0 协议</a> ，转载请注明出处！
                  
                </p>
              
              
                <div class="post-prevnext">
                  <article class="post-prev col-6">
                    
                    
                      <a href="/2021/04/17/Kali-Linux%E7%81%AB%E7%8B%90%E6%B5%8F%E8%A7%88%E5%99%A8%E5%AE%89%E8%A3%85burp%E8%AF%81%E4%B9%A6/">
                        <i class="iconfont icon-arrowleft"></i>
                        <span class="hidden-mobile">Kali_Linux火狐浏览器安装burp证书</span>
                        <span class="visible-mobile">上一篇</span>
                      </a>
                    
                  </article>
                  <article class="post-next col-6">
                    
                    
                      <a href="/2020/12/25/BUUCTF-wp/">
                        <span class="hidden-mobile">BUUCTF wp(持续更新中)</span>
                        <span class="visible-mobile">下一篇</span>
                        <i class="iconfont icon-arrowright"></i>
                      </a>
                    
                  </article>
                </div>
              
            </div>

            
              <!-- Comments -->
              <article class="comments" id="comments" lazyload>
                
                  
                
                
  <div id="twikoo"></div>
  <script type="text/javascript">
    Fluid.utils.loadComments('#comments', function() {
      Fluid.utils.createScript('https://cdn.jsdelivr.net/npm/twikoo@1/dist/twikoo.all.min.js', function() {
        var options = Object.assign(
          {"envId":"blog-3gentarg3e6a1b5e","region":"ap-shanghai","path":"window.location.pathname"},
          {
            el: '#twikoo',
            path: 'window.location.pathname',
            onCommentLoaded: function() {
              Fluid.plugins.initFancyBox('#twikoo .tk-content img:not(.tk-owo-emotion)');
            }
          }
        )
        twikoo.init(options)
      });
    });
  </script>
  <noscript>Please enable JavaScript to view the comments</noscript>


              </article>
            
          </article>
        </div>
      </div>
    </div>
    
      <div class="d-none d-lg-block col-lg-2 toc-container" id="toc-ctn">
        <div id="toc">
  <p class="toc-header"><i class="iconfont icon-list"></i>&nbsp;目录</p>
  <div class="toc-body" id="toc-body"></div>
</div>

      </div>
    
  </div>
</div>

<!-- Custom -->


    

    
      <a id="scroll-top-button" aria-label="TOP" href="#" role="button">
        <i class="iconfont icon-arrowup" aria-hidden="true"></i>
      </a>
    

    
      <div class="modal fade" id="modalSearch" tabindex="-1" role="dialog" aria-labelledby="ModalLabel"
     aria-hidden="true">
  <div class="modal-dialog modal-dialog-scrollable modal-lg" role="document">
    <div class="modal-content">
      <div class="modal-header text-center">
        <h4 class="modal-title w-100 font-weight-bold">搜索</h4>
        <button type="button" id="local-search-close" class="close" data-dismiss="modal" aria-label="Close">
          <span aria-hidden="true">&times;</span>
        </button>
      </div>
      <div class="modal-body mx-3">
        <div class="md-form mb-5">
          <input type="text" id="local-search-input" class="form-control validate">
          <label data-error="x" data-success="v"
                 for="local-search-input">关键词</label>
        </div>
        <div class="list-group" id="local-search-result"></div>
      </div>
    </div>
  </div>
</div>
    

    
  </main>

  <footer class="text-center mt-5 py-3">
  <div class="footer-content">
     <div class="copyright">&copy;2020 - 2021 By Kerosene.W</div> <a href="https://hexo.io" target="_blank" rel="nofollow noopener"><span>Hexo</span></a> <i class="iconfont icon-love"></i> <a href="https://github.com/fluid-dev/hexo-theme-fluid" target="_blank" rel="nofollow noopener"><span>Fluid</span></a> 
  </div>
  
  <div class="statistics">
    
    

    
      
        <!-- LeanCloud 统计PV -->
        <span id="leancloud-site-pv-container" style="display: none">
            总访问量 
            <span id="leancloud-site-pv"></span>
             次
          </span>
      
      
        <!-- LeanCloud 统计UV -->
        <span id="leancloud-site-uv-container" style="display: none">
            总访客数 
            <span id="leancloud-site-uv"></span>
             人
          </span>
      

    
  </div>


  

  
</footer>


  <!-- SCRIPTS -->
  
  <script  src="https://cdn.jsdelivr.net/npm/nprogress@0/nprogress.min.js" ></script>
  <link  rel="stylesheet" href="https://cdn.jsdelivr.net/npm/nprogress@0/nprogress.min.css" />

  <script>
    NProgress.configure({"showSpinner":false,"trickleSpeed":100})
    NProgress.start()
    window.addEventListener('load', function() {
      NProgress.done();
    })
  </script>


<script  src="https://cdn.jsdelivr.net/npm/jquery@3/dist/jquery.min.js" ></script>
<script  src="https://cdn.jsdelivr.net/npm/bootstrap@4/dist/js/bootstrap.min.js" ></script>
<script  src="/js/events.js" ></script>
<script  src="/js/plugins.js" ></script>

<!-- Plugins -->


  <script  src="/js/local-search.js" ></script>



  
    <script  src="/js/img-lazyload.js" ></script>
  



  



  
    <script  src="https://cdn.jsdelivr.net/npm/tocbot@4/dist/tocbot.min.js" ></script>
  
  
    <script  src="https://cdn.jsdelivr.net/npm/@fancyapps/fancybox@3/dist/jquery.fancybox.min.js" ></script>
  
  
    <script  src="https://cdn.jsdelivr.net/npm/anchor-js@4/anchor.min.js" ></script>
  
  
    <script defer src="https://cdn.jsdelivr.net/npm/clipboard@2/dist/clipboard.min.js" ></script>
  




  <script defer src="/js/leancloud.js" ></script>



  <script  src="https://cdn.jsdelivr.net/npm/typed.js@2/lib/typed.min.js" ></script>
  <script>
    (function (window, document) {
      var typing = Fluid.plugins.typing;
      var title = document.getElementById('subtitle').title;
      
        typing(title);
      
    })(window, document);
  </script>












  

  

  

  

  

  





<!-- 主题的启动项 保持在最底部 -->
<script  src="/js/boot.js" ></script>


</body>
</html>
